This paper presents a novel differential fault attack (DFA) on the Grain-128AEAD stream cipher that integrates fault signature analysis with machine learning and reinforcement learning. The proposed attack operates under a realistic adversarial model in which the attacker can target a register but cannot control the precise fault location. We first develop a signature-based technique and two machine learning models, namely Random Forest and Gradient Boosted Trees, for fault location identification, which achieve over 99.9% accuracy. We then introduce a Multi-Armed Bandit (MAB) framework to identify optimal fault targets that maximize information gain for state recovery. Experimental results show that our MAB-driven strategy recovers the 256-bit internal state of the cipher with an average of 96 and 134 faults under the precise and random fault models, respectively.

In this paper, we show that stream ciphers with a particular form of ciphertext output function are vulnerable to differential fault attacks using random faults. The CAESAR competition candidates Tiaoxin-346 and AEGIS-128L both fall into this category, and we show that our attack can be used to recover the secret key of Tiaoxin-346 and the entire state of AEGIS-128L with practical complexity. In the case of AEGIS-128L, the attack can be applied in a ciphertext-only scenario. Our attacks are more practical than previous fault attacks on these ciphers, which assumed bit-flipping faults. Although we also consider other ways of mitigating our attacks, we recommend that cipher designers avoid the form of ciphertext output function that we have identified.

The recently proposed algebraic attack has been proved to be very powerful against certain type of structure dependent cryptographic schemes especially LFSR-based stream ciphers. In this paper, we have investigated the algebraic attack against summation type of keystream generators. We have analysed the algebraic attack for three particular summation type generators: Rueppel’s summation generator, LM generator and PingPong keystream generator. The efficiency of the algebraic attack against these generators are compared in terms of time, data and memory complexity. It will be shown that the, Rueppel’s summation generator and the LM generator can be broken down with much less complexity compare to the exhaustive key search. However, for the case of PingPong stream cipher, we have found that it is infeasible to recover the secret key based on algebraic attack, mainly due to the irregular clock controlling function employed in the PingPong keystream generator.